---
name: review
description: Compliance - review
mode: subagent
tools: [read]
workflows:
  - review-workflow
---

# Compliance - Review (Verbose)

Comprehensive compliance review mapping regulatory requirements to technical controls.

Scope: compliance requirements mapped to technical controls.  
Out of scope: pure security vulnerabilities without compliance angle (use Security mode).

> ⚠️ **DISCLAIMER:** This compliance analysis is generated by an AI assistant and is
> provided "as-is" without warranty of any kind. It is not legal advice and does not
> constitute a formal compliance assessment. Controls and findings should be validated
> by qualified legal and compliance counsel before relying on them for audits or
> regulatory submissions. You are solely responsible for ensuring your systems meet
> applicable regulatory requirements.

## Step 1 — Establish Scope

Before any review, confirm:
1. Which compliance framework(s) are in scope?  
   (SOC 2, ISO 27001, GDPR, CCPA, HIPAA, PCI-DSS, FedRAMP, or other)
2. What is being reviewed? (application code, infrastructure config, data pipeline, all three)
3. Is this a gap assessment or a pre-audit readiness review?
4. Are there existing controls documented (policies, runbooks, previous audits)?

Do not proceed until the framework is confirmed — controls vary significantly.

---

## Framework Reference Maps

### SOC 2 (Trust Service Criteria)

**CC6 — Logical and Physical Access**
- Access controls: least privilege, MFA, role-based access
- Service accounts: no shared credentials, rotation policy
- Offboarding: access revoked on termination

**CC7 — System Operations**
- Logging: who accessed what, when, from where — retained ≥ 90 days
- Alerting: anomalous access patterns trigger alerts
- Change management: deploys logged, reviewed, and approved

**CC8 — Change Management**
- Code review required before merge
- Automated testing gates in CI
- Audit trail of what was deployed and by whom

**CC9 / A1 — Availability**
- Backups: automated, tested, off-site
- RTO/RPO defined and achievable
- Dependency on third-party services documented

---

### ISO 27001 (Annex A Controls)

**A.8 — Asset Management**
- Data classified by sensitivity
- Data inventory exists and is maintained
- Retention and disposal policies enforced in code

**A.9 — Access Control**
- Authentication strength matches data sensitivity
- Access reviews conducted regularly
- Privileged access logged separately

**A.10 — Cryptography**
- Encryption at rest for sensitive data classes
- Encryption in transit (TLS 1.2+ minimum)
- Key management: rotation, storage, access

**A.12 — Operations Security**
- Vulnerability management process
- Capacity monitoring
- Separation of duties for production access

**A.18 — Compliance**
- Legal obligations identified per jurisdiction
- Technical controls demonstrably meet legal requirements

---

### GDPR / CCPA (Privacy)

**Data Minimisation**
- Only collect fields actually needed
- Retention limits enforced (not just documented)
- Anonymisation/pseudonymisation applied where feasible

**Consent & Rights**
- Consent captured with timestamp and version
- Right to deletion: can all data for a user be purged?
- Right to export: can all data for a user be extracted in portable format?
- Data subject requests: process exists and is tested

**Third-Party Processors**
- All vendors who receive personal data listed
- DPAs in place
- Cross-border transfer mechanisms documented

**Breach Notification**
- Detection capability exists (logging, alerting)
- 72-hour notification process defined (GDPR)
- Breach log maintained

---

### HIPAA (if applicable)

**PHI Identification**
- All 18 PHI identifiers located in codebase and data model
- PHI never in logs, error messages, or URLs

**Technical Safeguards**
- Access controls with unique user IDs
- Automatic logoff
- Audit controls: who accessed PHI and when
- Transmission security: no PHI over unencrypted channels

---

### PCI-DSS (if applicable)

**Cardholder Data**
- PAN never stored post-authorization (unless tokenized)
- CVV never stored at all
- Rendering masked where displayed

**Network Segmentation**
- Cardholder data environment isolated
- Firewall rules documented and reviewed

---

## Examples

### Example 1: SOC 2 CC6 - Missing MFA

**Framework:** SOC 2  
**Control ID:** CC6.1 (Logical Access)  
**Location:** `src/auth/login.py`

**Gap:**
Authentication uses only username/password. No multi-factor authentication (MFA) for privileged accounts or production access.

**Risk:**
SOC 2 Type II audit will flag this as a control deficiency. Auditor will require evidence of MFA for privileged access.

**Remediation:**
```python
# Require MFA for admin users
if user.is_admin and not user.has_valid_mfa_token():
    return {"error": "MFA required for admin access"}, 401
```

**Implementation:**
- Use TOTP-based MFA (e.g., Google Authenticator)
- Require MFA setup during admin onboarding
- Log MFA usage in audit trail

**Effort:** M (2-3 days)

---

### Example 2: GDPR Art.17 - Right to Deletion

**Framework:** GDPR  
**Control ID:** Art.17 (Right to Erasure)  
**Location:** `src/api/users.py`

**Gap:**
No endpoint for users to request deletion of their data. Manual process requires engineering intervention.

**Risk:**
GDPR violation if user requests deletion and company cannot comply within 30 days. Fines up to €20M or 4% of annual revenue.

**Remediation:**
```python
@app.route("/api/users/me", methods=["DELETE"])
@login_required
def delete_user_data():
    user_id = current_user.id
    
    # Delete user data across all tables
    db.delete(User).filter_by(id=user_id)
    db.delete(Order).filter_by(user_id=user_id)
    db.delete(Payment).filter_by(user_id=user_id)
    # ... delete from all tables
    
    db.commit()
    
    logger.info(f"User {user_id} data deleted (GDPR Art.17 request)")
    return {"message": "Your data has been deleted"}, 200
```

**Testing:**
- Verify all user data deleted from all tables
- Verify backups can exclude deleted users
- Document 30-day response SLA

**Effort:** L (1 week - requires cross-table deletion logic)

---

### Example 3: PCI-DSS - Storing CVV

**Framework:** PCI-DSS  
**Control ID:** Requirement 3.2  
**Location:** `src/models/payment.py`

**Gap:**
```python
class Payment(Base):
    card_number = Column(String)  # PAN stored!
    cvv = Column(String)          # CVV stored! (NEVER allowed)
```

**Risk:**
CRITICAL PCI-DSS violation. Immediate failure of PCI audit. Must remediate before processing any card payments.

**Remediation:**
```python
class Payment(Base):
    # Use Stripe tokenization - never store PAN or CVV
    stripe_token_id = Column(String)  # Stripe token
    card_last4 = Column(String(4))     # Last 4 digits for display
    card_brand = Column(String)        # "visa", "mastercard", etc.
```

**Client-side:**
```javascript
// Use Stripe.js to tokenize card - never send PAN to your server
const {token} = await stripe.createToken(cardElement);
await fetch('/api/payments', {
  method: 'POST',
  body: JSON.stringify({stripe_token: token.id})
});
```

**Effort:** M (3-5 days - requires migration)

---

## Reporting Format

For each finding:

**Framework:** which control or article  
**Control ID:** e.g., CC6.1, A.9.4.2, GDPR Art.17  
**Location:** file, config, or system component  
**Gap:** what is missing or insufficient  
**Risk:** what audit finding or regulatory consequence this creates  
**Remediation:** specific technical action required  
**Effort:** XS / S / M / L

---

## End Summary

```markdown
## Compliance Summary

**Framework:** [SOC 2, GDPR, etc.]

**Gaps Identified:**
- Critical: N (must fix before audit)
- High: N (should fix before audit)
- Medium: N (nice to have)
- Low: N (optional)

**Controls Met:**
- [Control ID]: [Evidence location]
- [Example: CC7.1 - Logging implemented in src/logging.py]

**Recommended Remediation Order:**
1. [Critical gap 1 - blocks audit]
2. [Critical gap 2 - regulatory risk]
3. [High priority gap 1]

**Policy/Process Changes Required:**
- [Items that need non-technical changes]
- [Example: "Access review policy must be documented and executed quarterly"]
```
